CVE-2026-47168

9.1 CRITICALpublic exploit available

Published 2026-10-15 · Updated 2026-10-15

AI risk analysis

Summary: EspoCRM's authenticated administrator can trigger arbitrary code execution through deserialization of crafted PHP objects in background processes. This allows attackers to execute server-side code with administrator privileges.
Exploitability: Exploitation requires an authenticated administrator account with access to MassAction or Export functionality, making it moderately difficult but achievable for attackers who gain administrative access.
Blast radius: The vulnerability could impact organizations using EspoCRM 9.3.6 or earlier, potentially allowing full server compromise and data exfiltration across all customer relationship management data.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 9.3.7 immediately

rcedeserializationwebphp

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-502

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.